A researcher recently disclosed an AI-assisted Linux kernel zero-day vulnerability, tracked as CVE-2026-53264, which allows local privilege escalation to root on affected systems.
This flaw is found in the Linux packet scheduling subsystem (net/sched) and arises from a use-after-free condition involving traffic-control action objects.
AI-Discovered Linux Kernel Zero-Day
Star Labs researcher developed a reliable exploit targeting CentOS Stream 9 Desktop for the TyphoonPwn 2026 competition, demonstrating how AI can enhance bug hunting and exploit development workflows, while still requiring significant human validation and technical expertise.
The vulnerability impacts how net/sched manages shared packet-handling actions via its per-network-namespace action identifier registry. In the vulnerable path, the kernel function tcf_idr_check_alloc() looks up an action object while holding an RCU read lock.
However, another execution path can delete and free that same object under different locks without waiting for an RCU grace period, creating a race condition. An attacker could potentially cause the kernel to access an action object after it has already been freed.
To successfully exploit this vulnerability, the attacker must take advantage of a very narrow timing window. The freed action object must be quickly reclaimed with attacker-controlled data before the kernel checks and increments its reference count.
The researcher used Linux traffic-control netlink operations, specifically filter creation and deletion requests, to trigger the race condition.
Although direct action-management operations typically require elevated network-administration permissions in the initial namespace, the exploit can function through a separate user namespace where the process has CAP_NET_ADMIN capabilities.
The attack requires unprivileged user namespaces to be enabled and relies on specific net/sched features, including clsact queuing disciplines and flower classifiers. While these conditions may reduce exposure in hardened environments, they are commonly available in desktop-oriented Linux configurations.
The disclosed proof-of-concept was tested against CentOS Stream 9 images and reportedly achieved root privilege escalation in multiple runs, with execution times ranging from seconds to several minutes depending on race reliability and CPU conditions.
To enhance the consistency of the exploit, the researcher employed timerfd and epoll mechanisms to widen the race window, used separate threads across CPU cores, and assigned racing operations to different traffic-control chains.
This optimization decreased the estimated time to trigger the use-after-free vulnerability from over 151,515 minutes to approximately 555 seconds in the testing setup. The exploit then reclaimed the freed kernel object by utilizing user key payload allocations created through KEYCTL_UPDATE operations.
After reclaiming the object, the exploit leveraged an indirect function call from the corrupted action structure to gain control of the kernel instruction pointer. It also exploited a kernel address-space layout randomization leak and a return-oriented programming chain to overwrite the kernel’s core_pattern setting.
Triggering a crash subsequently led Linux to invoke an attacker-controlled core dump handler, executing it with root privileges in the initial namespace.
This flaw is believed to have existed for approximately 2 to 3 years before its disclosure. A stable patch for the Linux kernel is available through commit 5057e1aca011e51ef51498c940ef96f3d3e8a305.
Organizations are urged to promptly deploy vendor kernel updates, evaluate whether unprivileged user namespaces are necessary, and restrict them wherever feasible.
Security teams should also review systems that expose traffic-control functionality to untrusted local users, particularly on shared workstations, developer endpoints, and multi-user Linux environments.
This research highlights a growing security concern: AI-assisted analysis can make previously undiscovered vulnerabilities easier to identify by accelerating pattern matching, proof-of-concept creation, and race-condition optimization.
However, the researcher emphasized that AI is still susceptible to reasoning errors and blind spots, making in-depth knowledge of subsystems crucial for identifying genuine attack paths and developing reliable exploits.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
